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In order to study multipartite quantum cryptography, we 
introduce quantities which vanish on product probability dis- 
tributions, and which can only decrease if the parties carry 
out local operations or carry out public classical communi- 
cation. These "secrecy monotones" therefore measure how 
much secret correlations are shared by the parties. In the bi- 
partite case we show that the mutual information is a secrecy 
monotone. In the multipartite case we describe two differ- 
ent generalisations of the mutual information, both of which 
are secrecy monotones. The existence of two distinct secrecy 
monotones allows us to show that in multipartite quantum 
cryptography the parties must make irreversible choices about 
which multipartite correlations they want to obtain. Secrecy 
monotones can be extended to the quantum domain and are 
then defined on density matrices. We illustrate this generali- 
sation by considering tri-partite quantum cryptography based 
on the Greenberger-Horne-Zeilinger (GHZ) state. We show 
that before carrying out measurements on the state, the par- 
ties must make an irreversible decision about what probability 
distribution they want to obtain. 

I. INTRODUCTION 

Quantum cryptography uses the uncertainty princi- 
ple of quantum mechanics to allow two parties to com- 
municate secretly Q. It has been extensively studied 
during the last decade both theoretically and experi- 
mentally (see e.g. [Q for a review). The basic idea of 
a quantum cryptographic protocol is that two parties, 
Alice and Bob, use a quantum communication channel 
to exchange an entangled state ^ab- Local measure- 
ments yield correlated results and allow them to obtain 
a certain number of shared secret bits P\ B uncorre- 
cted with Eve, defined by the probability distribution 
Pl B (0, 0) = P% B {1, 1) = 1/2. These resulting secret bits 
can then be used for secure cryptography, using e.g. the 
one-time pad scheme. An eavesdropper, Eve, will neces- 
sarily disturb the quantum state ^ ab when attempting 
to get information on the secret bits, and will therefore be 
detected by Alice and Bob. A central problem of quan- 
tum cryptography is to establish the maximum rate at 
which Alice and Bob can establish a secret key for a given 
level of disturbance by Eve. 

Independently of quantum cryptography, Maurer has 
introduced a paradigm for classical cryptography based 
on probabilistic correlations between two parties, Alice 
and Bob, and an eavesdropper Eve ||. Specifically, sup- 
pose that Alice, Bob, and Eve have several independent 



realizations of their three random variables, distributed 
each according to the probability distribution Pabe- The 
goal is for Alice and Bob to distill, from these realizations, 
a maximal number of shared secret bits P\ B - The tools 
available to Alice and Bob to perform this distillation 
are local operations and classical public communications 
(LOCC). An important question is to estimate the max- 
imum rate at which the parties can generate the secret 
bits. Bounds on this secret bits distillation rate have 
been obtained in Q. 

Quantum cryptography and Maurer's cryptographic 
paradigm are closely related. Indeed, after measuring 
their quantum bits, the parties A, B and E end up in ex- 
actly the situation considered by Maurer. Therefore, dis- 
tillation protocols used in Maurer's cryptographic scheme 
can be adapted to the quantum situation [^J. Moreover, 
ideas from quantum cryptography and quantum informa- 
tion theory have illuminated the structure of Maurer's 
cryptographic scheme ^] . 

In this paper, we will consider multipartite cryptog- 
raphy both from the point of view of Maurer's classi- 
cal cryptographic scheme and from the point of view 
of quantum cryptography. As in the papers mentioned 
above, these two approaches are complementary. We 
show that putting ideas from these two approaches to- 
gether provides new insights into multipartite cryptog- 
raphy. Let us first consider the extension of Maurer's 
cryptographic scenario to more than two parties. One 
supposes that the different parties A\,A%... A n , E pos- 
sess independent realizations of n + 1 random variables 
distributed according to the multipartite probability dis- 
tribution PA 1 A 2 ...A n E where E denotes the eavesdrop- 
per, as before. In this case, however, it is not obvious 
what the goal of the parties should be. For instance, 
in the case of three parties, one possible aim of the 
distillation process could be to maximize the resulting 
number of random bits shared between pairs of parties 
Pab^bc^ca- Another goal could be to generate effi- 
ciently the tripartite probability distribution P 3 defined 
by P| B(? (0,0,0) = Pj sc (l,l,l) = 1/2. This probabil- 
ity distribution allows any one of the parties to encrypt a 
message (by xORing it with his random variable and pub- 
licly communicating the result) in such a way that it can 
be decrypted by both the other parties independently. A 
third possibility could be to generate the probability dis- 
tribution P%_bc m which an y two random variables are 
independent random bits, while the third one is the XOR 
of the other two bits, P^ BC (0,0,0) = P| BC (1,1,0) = 
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PXbcO.,0,1) = P% BC (0,l,l) = 1/4. This probability 
distribution allows any one of the parties to encrypt a 
message (by xORing it with his random variable and pub- 
licly communicating the result) in such a way that it can 
only be decrypted if the other two parties get together 
and compute the XOR of their two random bits. 

One main result of the present paper is to show that 
in the multipartite case, the parties must decide before 
they start the distillation protocol which probability dis- 
tribution they want to obtain. Making the wrong choice 
entails an irreversible loss. For instance, the parties will 
in general obtain more triplets P 3 if they directly distill 
to P 3 than if they first distill to another kind of probabil- 
ity distribution, say shared random bits between pairs of 
parties P\bPbc^'ca^ anc ^ subsequently try to generate 
P 3 from these pairs of random bits. More generally, we 
address in this paper the question of the convertibility, 
using local operations and public communication, of one 
multipartite probability distribution into another one. 

As mentioned above, these issues can be generalized to 
quantum-mechanical systems in the context of quantum 
cryptography. We thus aim at addressing the same ques- 
tions of the convertibility between quantum multipartite 
density operators in this paper. An important potential 
application of this extension is to provide bounds on the 
yields of multi-partite quantum cryptography. Indeed, in 
quantum cryptography, the parties start with a quantum 
state (in general a mixed state) and, by carrying out local 
operations, measurements, and classical communication, 
they aim at obtaining a multi-partite classical probabil- 
ity distribution (which can of course be viewed as a par- 
ticular kind of mixed quantum state). Bounds on the 
interconvertibility of multipartite quantum states have 
been studied by several authors (see for instance [fz| — p~0|| ) , 
but most of this work has focused on pure states. The 
interconvertibility of mixed states, and, in particular, ap- 
plications to multipartite cryptography, have so far been 
relatively little studied. As an illustration, we consider 
in detail the case of quantum cryptography based on the 
GHZ state ^ GH z = (|000) + |lll))/\/2. By measuring 
^GHZ in the z basis the parties can obtain the proba- 
bility distribution P 3 , while by measuring in the x basis, 
they can obtain the probability distribution P x . We show 
that the parties cannot obtain more than one 

p3 

or one 

P x distribution per GHZ state. Combining this with the 
bounds stated above, we see that when extracting cor- 
relations from the GHZ state, the parties must make an 
irreversible choice of what kind of tripartite correlations 
they want to obtain. 

In order to study these interconvertibility issues, we 
have developed a tool which we call secrecy monotones. 
These are functions of the multipartite probability dis- 
tributions (or, more generally, of the quantum density 
operators) that can only decrease under local operations 
and public classical communication. Therefore, compar- 
ing the value of the monotone on the initial and the tar- 
get probability distribution allows one to obtain an upper 
bound on the number of realizations of the target prob- 



ability distribution that can be obtained from the initial 
probability distribution. In fact, the upper bounds ob- 
tained in H and in jjj on the secret key distillation rate 
in the bipartite case can be reexpressed in terms of the 
existence of certain bipartite secrecy monotones. 

Monotones have proved to be extremely useful for the 
study of quantum entanglement (see for instance p| ), 
in which context they are called entanglement mono- 
tones. Our study of secrecy monotones is closely inspired 
by these works on entanglement monotones. Entangle- 
ment monotones are positive and vanish on unentangled 
density matrices, which implies that they measure the 
amount of entanglement in a density matrix. In a similar 
way, secrecy monotones are positive and vanish on prod- 
uct probability distributions (or product density opera- 
tors), so that they measure the amount of both classical 
and quantum correlations between the parties. In the 
present paper, we introduce two information-theoretic 
multipartite secrecy monotones (called S n and T n ), which 
can be viewed as the multipartite extension of the (clas- 
sical or quantum) mutual information of a bipartite sys- 
tem. The definition of the quantum mutual information 
was discussed in |l2| , and its use in the context of quan- 
tum channels was investigated in details in |13|. Here, 



this quantity is shown to be a monotone, and extended 
to multipartite systems. In particular, we discuss sev- 
eral applications of these monotones to the special case 
of three parties. 

The paper is organised as follows. The first sections of 
the paper are devoted exclusively to the classical secrecy 
monotones. We begin in section [n] by giving a general 
definition of classical secrecy monotones and studying the 
implications of this definition. In section III we intro- 



duce two specific multipartite secrecy monotones S n and 
T n which are the multipartite generalization of the bi- 
partite mutual entropy. Most of this section is devoted 
to proving that these functions obey all the properties 
of a secrecy monotone. In section we use these two 
secrecy monotones to study the particular case of tri- 
partite cryptography. In particular we address the ques- 
tion raised above concerning the interconvertibility of the 
probability distributions P\b> P|c Pca> ^ABC anc ^ 
P%bc ■ Finally in section |V], we study the generalization 
of the classical secrecy monotones to quantum mecha- 
nis. In particular, we show that the monotones S n and 
T n have natural quantum analogues that have important 
applications to multipartite quantum cryptography. As 
an illustration, we study bounds on quantum cryptogra- 
phy based on the GHZ state. 



II. PROPERTIES OF SECRECY MONOTONES 

A. Defining properties 

A secrecy monotone is a function M defined on multi- 
partite probability distributions PA 1 A 2 ...A n E which obeys 
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a series of properties which we now review and explain. 
(We restrict ourselves to the classical case, the quantum 
case will be analyzed in section [v].) We will denote the 
monotone either M(P Ai a 2 ...a„e) or M(Al:A2: . . . :A n :E) 
where the semicolons separate the different parties. 

The first two properties ensure that M provides a mea- 
sure of the amount of correlations between the parties. 
1) Semi-positivity: 



M(P AlJ 



■ A n E 



)>o 



2) Vanishing on product probability distributions: 

if PaiA 2 ...A„E = Pa x ePaiE ■ ■ ■ Pa„e , 
then M{P AlE P A2E . . . P AnE ) = . 



(1) 



(2) 



The next two properties express the monotonicity of M 
under LOCC, namely the fact M can only decrease if one 
of the parties performs some local operation (e.g. ran- 
domization) or publicly discloses (partly or completely) 
the value of his variable. Thus, these monotonicity prop- 
erties imply that M describes the amount of correlations 
not shared with Eve. They also make M useful for study- 
ing the convertibility of one probability distribution into 
another. 

3) Monotonicity under local operations. 
Suppose that party Aj carries out a local transformation 
that modifies Aj to Aj according to the conditional prob- 
ability distribution P A .\ Aj - Then M can only decrease: 



if Pa 



= r \ A P A 1 -A ' 



A 1 ...A j ...A n E — 1 Aj\Aj 

then M(P Al A . AnE ) < M(P Al ... Aj ... AnE ) . (3) 

4) Monotonicity under public communication. 
Suppose that party j publicly discloses the value of Aj , 
where Aj depends on j's variable Aj according to the 
conditional probability distribution P Aj \ Aj ■ Then M can 
only decrease: 



M{P Al ... Aj ... AnE \ A] ) < M{P Al ... Aj ... AnE ) 



(4) 



The next two properties are important if the secrecy 
monotone is to provide information on the asymptotic 
rate of convertibility of one probability distribution into 
another. By this, we mean that the parties initially have 
a large number n of realizations of the probability dis- 
tribution P 1 and want to obtain a large number m of 
realizations of the probability distribution P 2 . Property 
5 ensures that one can use the monotone M to study 
the asymptotic limit n,m — > oo. Property 6 allows one 
to study the situation where one does not want to ob- 
tain the exact probability distribution (p 2 )® m ) but only 
a probability distribution that is close to (P 2 )® m . 

5) Additivity: 



M(P 1 <g> P 2 ) = M(P 1 ) + M(P 2 



(5) 



Note that one may also impose only the weaker condi- 
tion M(P® n ) = nM{P) (see JT1 for a motivation for 



considering only this weaker condition in the case of en- 
tanglement). 

6) Continuity: 

M (P) is a continuous function of the probability distri- 
bution P. We will not make more explicit the condition 
that this imposes on M since the monotones we will ex- 
plicitly describe below are highly smooth functions of P. 
We refer to |p"i"|| where a weak continuity condition is in- 
troduced and motivated in the context of entanglement. 

Finally, we introduce two additional properties which 
are natural to impose if the monotone is to measure the 
amount of secrecy shared by the parties A\ . . . A n , with 
E viewed as a hostile party. Indeed, these final proper- 
ties express the fact that the secrecy can only increase 
if E looses information either by performing some local 
operation or by publicly disclosing (in part or totally) his 
variable. 

7) Monotonicity under local operations by Eve. 
Suppose that Eve carries out a local transformation 
which modifies E to E according to the conditional prob- 
ability distribution P E \ E . Then M can only increase: 



if PA x ...A n E — PE\EPA x ...A n E , 

then M(P Al _ AnE ) > M(P Al ... AnE ) 



(6) 



8) Monotonicity under public communication by Eve. 
Suppose that Eve publicly discloses the value of E, where 
E depends on Eve's variable E according to the condi- 
tional probability distribution P E \ E - Then M can only 
increase: 

M{P M ... AnE]E ) > M(P Al ... AnE ) . (7) 



B. Consequences of the defining properties 

1. Upper bound on the yield 

The most important consequence of the defining prop- 
erties is that a monotone allows one to obtain a bound on 
the rate at which a multipartite probability distribution 
P 1 can be converted into another probability distribu- 
tion P 2 using LOCC. Suppose that the parties are able, 
using LOCC, to convert n realizations of P 1 into some 
realization of a probability distribution P 2 which is close 
to m independent realizations of the desired probability 
distribution P 2 : 



(P 1 ) 



.P Z 



2\<S>m 



LOCC 

The yield of this distillation protocol is defined as 

?« 
n 



Y, 



(8) 



(9) 



The existence of a secrecy monotone M allows us to put 
a bound on the yield. Indeed, from Eq. (||), we have 

M((P v f n ) = nM{P l ) > M(P 2 ') ~ mM{P 2 ) (10) 
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where we have used the defining properties of M (addi- 
tivity, monotonicity and continuity). Hence, using the 
positivity of M, we obtain 



Y P 



< 



MiP 1 ) 
M(P 2 ) 



(11) 



2. Monotones that do not involve Eve 

In practice, it is often much easier to construct a re- 
stricted type of monotones M that are only defined on 
probability distributions PaiA 2 -.A„ that do not depend 
on E. These simple monotones are therefore applica- 
ble only to the cases where Eve initially has no infor- 
mation about the probability distribution. Importantly, 
one can easily extend such monotones M to more gen- 
eral monotones M defined on probability distributions 
PA 1 A 2 ...A n E that also include initial correlations with 
Eve. The simplest way to carry out this extension is to 
calculate the probability distributions Pa 1 a 2 ...a„\e con- 
ditional on Eve's variable E, and then to average the 
values of M on the conditional probability distribution. 
This yields a monotone M\\ 

M^Pa^.^e) = J2 P ( E ) M ( P AiA 2 ...A n \E) ■ 
E 

The monotone Mi thus constructed obeys property 8, 
but in general does not obey property 7 Q. 

In order to obtain a monotone that obeys both proper- 
ties 7 and 8, before computing the conditional probability 



distribution P 



AiA 2 ...A„\E 



we first need to take the mini- 



mum over Eve's operations. This transforms the variable 
E into E according to P(E\E). This procedure yields a 
new monotone M±: 

M i {P Al A^..A n E) = mm ^2P(E)M l (P AlA2 ^ AnlB ) . 

P(E\E)^ 1 
E 

Note that it is this second procedure that was used in 0] 
to obtain a strong upper bound on the rate of distillation 
of a secret key. 



3. Extending monotones to more parties 

A monotone defined on a n-partite probability distri- 
bution can be extended in a natural way to a mono- 
tone on a m-partite probability distribution with m > n. 
Let us illustrate this procedure in the case of a bipar- 
tite monotone M2(A:B) extended to a tripartite case. A 
tripartite monotone for the variables A, B, and C is sim- 
ply M2(AB:C) and can be interpreted as the bipartite 
monotone which would be obtained if parties A and B 
get together. We can of course group the parties in many 
different ways, and therefore M 2 (AC:B) and M 2 (BC:A) 
are two other independent tripartite monotones. These 



three monotones are distinct from the genuinely tripar- 
tite monotones that can be constructed on Pabc-, a s we 
will show later on, and lead to independent conditions on 
the convertibility of tripartite distributions. 



III. TWO CLASSICAL MULTIPARTITE 
SECRECY MONOTONES 

We now introduce two information-theoretic multipar- 
tite secrecy monotones for n parties A\,...A n (with 
n > 2) sharing some classical probability distribution 
Pa.!— An- We shall suppose that Eve initally has no 
knowledge about the probability distribution. The gen- 
eralization to the case where the probability dis tribut ion 
depends on E can be done as shown in section [I B 2 . 



A. Amount of shared randomness between the 
parties: S n 

The first multipartite secrecy monotone is denoted S n 
and defined by 

S n {Ai: ■ ■ ■ :A n ) = H{A 1 ■ ■ ■ A n ) 

n 

-Y J H{A i \A 1 ---A i _ l A i+1 ---A n ) (12) 

8=1 

where H(A) denotes the Shannon entropy of variable A 
distributed as Pa, that is, H(A) = — J2 a Pa^°SPa- 

In order to provide a physical interpretation to S n , we 
note that the first term on the right hand side of Eq. jl^ ) 
is the total randomness of the probability distribution 
PAf A n whereas the subtracted terms arc the amounts 
of randomness that are purely local to each party. Thus 
S n measures the number of bits of shared randomness 
between the n parties (irrespective of them being shared 
between two, three, or more parties, but not including the 
local randomness). On the basis of this interpretation it 
is natural that if one of the parties publicly reveals some 
of his data, this will decrease S n since the total number 
of bits of shared randomness has decreased. This remark 
suggests that S n should be a secrecy monotone. That 
this is indeed the case will be proven below. 

We begin by introducing two alternative expressions 
for S n : 

n 

SniAr.--- :A n ) = J2 H{Ai ■ ■ ■ A l ^ 1 A i+1 ■ ■ ■ A n ) 

i=l 

-(n-l)H{A 1 ---A n ) (13) 



and 



S n (A 1 :---:A n )=I(A 1 :A 2 A 3 ---A n ) 

n-l 

+ I{Ai-.A i+1 ■ ■ ■ A n \A t ■ ■ ■ Ai-i) , (14) 

i=2 
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where I(A:B\C) = H(AC) + H{BC) - H{C) - H(ABC) 
is the conditional mutual information between A and B 
given C. The proof of these different equivalent expres- 
sions follows from the following recurence relation for S n : 

S n (Ai: ■ ■ ■ :A n ) = S n -i(Ai: ■ ■ ■ :A n ^A n ) 

+ I{A n ^ 1 :A n \A 1 ---A n _ 2 ) . (15) 

These expressions allow us to derive the following sim- 
ple properties of S n : 

1. S n is symmetric under the interchange of any two 
parties Ai and Aj. This follows from Eq. fll^). 

2. S n is semi-positive. This follows from Eq. ( H ) 
and from the positivity of the conditional mutual 
entropy, I(A:B\C) > 0, which itself follows from 
the strong subbaditivity of Shannon entropies. 

3. S n is additive. 

4. S n vanishes on product probability distribution 
P = P Al P A2 ...P An . 

5. For two parties S 2 is the mutual information 

S 2 (A:B) = H{A) + H{B) - H(AB) 

= I{A:B) . (16) 

B. Local increase in entropy to erase all correlations: 

Tn 

The second secrecy monotone is defined as 

n 

T n {A r . ■ ■ ■ :A n ) = H ( A i) - H ( A i ■■■A n ). 

(17) 

In order to interpret this quantity we note that it is equal 
to the minimum relative entropy between the probabil- 
ity distribution P Al ...A„ and any product probability dis- 
tribution Q Al Q A2 ■ ■ ■ Qa„ (with the minimum being at- 
tained when the Q A . are equal to the local distributions 
Q Ai ): 

TniAr.----.An) 

= D{P Al ... A J\P Al P A2 ...P An ) 
= m inQ Ai Q A2 ...Q An D(P Al ...A n I \QAi Qa 2 ■ ■ ■ Qa„) ■ (18) 

where D(P A \\Q A ) = X) a ^'( a ) m ^f} ^ s ^ e relative en- 
tropy between the distributions P and Q. In order to give 
an interpretation to T n , we turn to recent work of Vedral 
Q (see also the review [^5|) who gave an interpretation 
of a related quantity, the relative entropy of entangle- 
ment, as the minimum increase of entropy of classically 
correlated environments needed to erase all correlations 



between the parties sharing an entangled states. (The 
relative entropy of entanglement is the minimum relative 
entropy between the entangled state and any separable 
state). Vcdral's argument can easily be extended to the 
present situation whereupon one finds that T n is the min- 
imum increase of entropy of local uncorrelated environ- 
ments if the parties erase all correlations between them 
by interacting locally with their environment. 

To proceed, we note that T n obeys the recurrence re- 
lation 

T n (A 1 :---:A n )=T n _ 1 (A 1 :---:A n _ 1 ) 

+ I(A n :A 1 ---A n -i) (19) 

which allows us to derive the following expression: 

T n (A 1 :---:A n )=I(A 1 :A 2 ) 

n-l 

+ J2l(A 1 ---A i :A i+1 ) . (20) 

These expressions allow us to derive the following sim- 
ple properties of T n : 

1. T n is symmetric under the interchange of any two 
parties Ai and Aj. This follows from Eq. (|l7j). 

2. T n is semi-positive. This follows from Eq. (|20|). 

3. T n is additive. 

4. T n vanishes on product probability distribution 
P = P Al P A . 2 ...P An . 

5. For two parties T 2 is the mutual information 

T 2 (A:B) = H(A) + H(B) - H{AB) 

= I(A:B). (21) 

C. Relation between S n and T n 

For two parties, S n and T n coincide and are equal to 
the mutual entropy between the parties. Thus, S n and 
T n can be viewed as two (generally distinct) multipar- 
tite extensions of the mutual information of a bipartite 
system. That these two generalizations are generally dis- 
tinct follows from the following relation between the two 
monotones: 

S n {A 1 :---:An)+T n {A x :---:An) 

71 

= y £ i I{A i :Ai---Ai-iA i+l ---A n ) . (22) 

i=l 

This expression will prove important in the interpretation 
of the monotones in the quantum case. 

Let us note that linear combinations of T n and S n of 
the form 

M n = XS n + (1 - \)T n , (23) 
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with < A < 1 are monotones as well. For the case of 
three parties, we will prove below that only for this range 
of A is M n a monotone. 



D. Monotonicity of S n and T n under local operations 

We now prove that S n is a monotone, i.e., it can can 
only decrease under LOCC. Local operations by party j 
correspond to carrying out a local transformation which 
modifies Aj to Aj according to the conditional probabil- 
ity distribution Pj. \ A . For example, let us choose A n to 
undergo such a transformation. We want to prove first 
that 

S n {Ai \ ■ ■ ■ :A n ) > S n (Ai: ■ ■ ■ :A n ) , (24) 
Using Eqs. © and (||), we find 

S n (Av- ■ ■ ■ :A n ) = —T n -\{A\: ■ ■ • :A n -i) 

n-l 

+ UAi-M ■ ■ ■ Ai-iA+i • • • ■ (25) 

i=l 

Clearly, only the second term on the right hand side is 
affected by the local operation on A n . As a consequence 
of the data processing inequality (see e.g. |]l6)), one can 
show that each term of the summation can only decrease 
under the transformation A n — > A n , 

IiAi-.A! ■ ■ ■ Ai-iAj+i ■ • • K-iAn) 
> I{Ai:A x ■ ■ ■ A^iA i+1 ■ ■ ■ A n -iA n ) . (26) 

For example, consider the term i = 1, and write the 
mutual information I(Ai:A 2 ■ ■ ■ A n A n ) in two equivalent 
ways: 

I(A t :A 2 ■ ■ ■ An-tAn) + I(Ai:A n \A 2 ■ ■ ■ A n ^A n ) 
= I{A 1 :A 2 --- A n ) + I(A 1 :A n \A 2 ■ ■ ■ A n ) (27) 

We have I{Ai:A n \A 2 ■ ■ ■ A n ) = since A\ and A n are 
conditionally independent given A n . Using strong subad- 
ditivity I(Ai:A n \A 2 ■ ■ ■ A n -iA n ) > 0, we conclude that 
I(Af.A 2 ■ ■ ■ A n ) > I(A X :A 2 ■ ■ ■ A n -iA n ). Finally, as S n 
is symmetric in all Aj , this proof is actually valid for local 
operation performed by all parties. 

In order to prove the monotonicity of T n under local 
operations, we assume, as above, that A n undergoes a 
local transformation to A n , and prove that 

T n (A 1 :---:A n ) > T n (A V . ■ ■ ■ :A n ) . (28) 

Using Eq. (jT|), we have 

T n {Ai:---:A n -i:A n ) 

= T„_ 1 (A 1 :---:A n _ 1 )+/(l„:A 1 ---A n _ 1 ) . (29) 

Again, due to the data processing inequality, the second 
term on the right hand side cannot increase as a result 
of the local transformation on A n , while the first term 
remains unchanged. This proves Eq. (p8|). Consequently, 
as T n is symmetric in all A^'s, it can only decrease under 
local operations of any party. 



E. Monotonicity of S„ and T n under public classical 
communication 

Now, let us consider the monotonicity of S n and T n 
under classical communications. Here, classical commu- 
nication means that one party makes its probability dis- 
tribution (partly or completely) known to all the other 
parties. Say, we choose the party A x to make Ai known 
to the public, where Ai is drawn from the conditional 
probability distribution P^lAx- We want to prove that 
S n is a monotone, that is, 

SniAn ■ ■ ■ :A n ) > 5 n (A i: ■ ■ • :A n \A 1 ) , (30) 

with the right hand side term being the monotone S n cal- 
culated from the probability distribution PA 1 ---A n \A 1 =cn 
averaged over all values a of Ai , or 

n 

SniAv, ■ ■ ■ -.A^Aj) = H ( A i ■ ■ ■ A i-i A i+i ■ ■ ■ A n\ A l) 

i=l 

-(n-l)H(A 1 ---A n \A 1 ) 
(31) 

Using Equation (|l4|), we have 

S n (A 1 :---:A n \A 1 )=I(A 1 :A 2 ---A n \A 1 ) 

+ J2l(A i :A i+1 ---A n \A 1 ---A i _ 1 A 1 ) , (32) 

The knowledge of Ai clearly only changes a conditional 
mutual information if A\ is not given. This is only the 
case in the first term on the right hand side of the above 
equation. Finally, we can prove that this term only 
decreases under classical communication by writing the 
mutual information I(AiAi:A 2 ■ ■ ■ A n ) in two equivalent 
ways 

I(A 1 :A 2 ---A n )+I(A 1 :A 2 ---A n \A 1 ) 
= I(A 1 :A 2 ■ ■ ■ An) + I{A X :A 2 ■ ■ ■ A n \A x ) (33) 

We have I{A\:A 2 - ■ ■ A n \A{) = since Ai is indepen- 
dent of A 2 ■ ■ ■ A n conditionally on A±. Then, using 
I(Ar-A 2 ■ ■ ■ A n ) > 0, we find that 

I(A 1 :A 2 ---A n ) >I(A 1 :A 2 ---A n \A 1 ) (34) 

which proves that S n is a monotone when party Ai makes 
Ai public. Since S n is symmetric in all parties, we have 
also proven that it decreases on average under classical 
communication between all parties. 

Let us finally prove the monotonicity of T n under clas- 
sical communications. If one of the parties, say Ai , makes 
A\ public, then T n changes according to 

Tn(Ar. ■ ■ ■ :A n ) > T n {A r . ■ ■ ■ -.A^M) . (35) 



G 



with the right hand side term being the monotone T n for 
the probability distribution ■P4. 1 ...yi„|Ai=a) averaged over 
all values a of A\, or 



T n (A\\ ■ ■ ■ xA^Ax) = HiAilAx) - H{A X ■ ■ ■ A n \A x ) 



(36) 



Using Equation (pp|), we have 



T n (A v ■ ■ • :A n |Ai) = T ( A i ' ' ' Ai-.A^At) (37) 

i=l 

As proven above, we have for all the terms on the right 
hand side 

I(A 1 ■ ■ ■ A z :A z+ i) > J(Ai • • • Ar.Ai+^Ax) (38) 

which proves that T n can only decrease under public com- 
munication of one party. This is true for all parties since 
T n is a symmetric quantity. 



IV. TRIPARTITE CLASSICAL SECRECY 
MONOTONES 

A. Five independent tripartite secrecy monotones 

For three parties A, B, and C, we have a closer look at 
the above secrecy monotones for classical probability dis- 
tributions. We start by writing the monotones explicitly 
in terms of entropies or mutual informations: 

S 3 (A:B:C) 

= H{AB) + H{BC) + H{AC) - 2H(ABC) 
= I(A:BC) + I(B:C\A) , (39) 
T 3 (A:B:C) 

= H(A) + H(B) + H(C) - H(ABC) 

= I(A:B) + I(AB:C) . (40) 

In addition to these two tripartite monotones, we 
also have three other monotones S2(A:BC) = I(A:BC), 
S 2 (B:AC) = I{B:AC) and S 2 {C:AB) = I(C:AB) which 
consist of evaluating the bipartite monotone S 2 on the 
probability distribution obtained by grouping two of the 
three parties together. Thus, there is a total of 5 tri- 
partite secrecy montones. These monotones are not all 
linearly independent as Eq. ( p2| ) shows. However, none of 
these monotones can be written as a linear combination 
of the other monotones with only positive coefficients. 
For this reason these 5 monotones give independent con- 
straints on the transformations that are possible under 
LOCC. 



B. Five particular probability distributions 

We begin by using these five tripartite monotones to 
investigate in detail five particular tripartite probability 
distributions. These five probability distributions play 
a particular role since they are, in a sense made precise 
below, the extreme points in a convex set. These five 
distributions consist of three bipartite distributions 



1/2, 



P| s (0,0)=Pl s (l,l) 
Pl c (0,0)=Pi c (l,l) = l/2 
P! c (0,0)=Pj c (l,l) = l/2 

and two tripartite distributions 



Pabc (0,0,0) 



Pi BC (l,l,l) = l/2 



and 



P% BC (0, 0, 0) - P% BC {1, 1,0) = P% BC {1, 0, 1) 



= p 



ABC 



(0,1,1) = 1/4 



(41) 
(42) 
(43) 



(44) 



(45) 



The first three probability distributions, Eq. (|l] - [43[) , 
are perfectly correlated shared random bits between two 
of the three parties, the fourth probability distribution, 
Eq. (44), is one shared random bit between the three 
parties, and the last probability distribution, Eq. d4S|), 
corresponds to the case where two parties share an un- 
corrected probability distribution while the third party 
has the exclusive-OR (xor) of the bits of these two par- 
ties. 

We can now make a table which lists for each of these 
probability distributions the values of the 5 tri-partite 
monotones. 





S 2 (A:BC) 


S 2 {B:AC) 


S 2 (C:AB) 


S 3 (ABC) 


T 3 (ABC) 


p2 
r AB 


1 


1 





1 


1 


r AC 


1 





1 


1 


1 


p2 
r BC 





1 


1 


1 


1 


Pabc 


1 


1 


1 


1 


2 


px 

* ABC 


1 


1 


1 


2 


1 



C. Converting a probability distribution into another 

We can use this table to study which probability dis- 
tributions can be converted into which others, and with 
what yield. The first thing we note from the table is 
that it forbids the conversion of a probability distri- 
bution P%bc m t° a probability distribution P\ BC and 
vice- versa, as S 3 {P X ABC ) > S 3 (Pl B g) and T 3 (P\ BC ) > 
T 3 (P ABC ) . This can be understood in the following way. 
The number of shared random bits underlying the dis- 
tribution P% BC is 2 (two parties must have uncorrelated 
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random bits) while it is only 1 for the distribution P\ BC 
(where the three parties share one common bit). Since 
the number of shared bits S3 is a monotone, one cannot 
go from P\ BC to P%bc- O n t ne other hand, the number 
of bits that must be forgotten in order to get three inde- 
pendent bits is equal to 2 for the distribution P%bc (two 
parties, say B and C, must randomize their bits), while 
it is only 1 for the distribution Pabc (where it is enough 
that party C forgets its bit in order to get independent 
bits). Since the number of bits that must be forgotten 
to get independent distributions T 3 is a monotone, one 
cannot go from P% BC to P\ BC - 

The above table also suggests that distillation proce- 
dures of the form P% BC — > P\ B or P\ BC — > P\ B arc 
possible. This is indeed the case: starting from P%bc> 
the party C simply has to make its bit public in order to 
get P\bi thereby reducing by one the number of shared 
bits S3. If we start with P%bc instead, the party C has to 
forget its bit, i.e., send it through a channel which com- 
pletely randomizes it. Thus, one bit must be forgotten, 
reducing by one the monotone T 3 . 

P X ABC and 



The transformations Pabc 



Pabc ~ * Pabc are a ^ so allowed by the above table 
of monotones, and we can check that they can actually 
be achieved. If the probability distribution is P\ B c^ 2 
and the parties want to have instead Pabc> then A has 
to forget the first of the two bits it has, B has to forget 
the second, and C just takes the sum of the two bits it 
has, forgetting the individual values. Thus, three bits 
must be forgotten, reducing the value of T 3 from 4 to 1. 
To get from Pabc® 2 to Pabc I s a little bit more com- 
plicated. We start with A having the bits x and x', B 
having the bits y and y' and C having the bits x + y and 
x' + y'. Now A makes x public and B makes y' public. 
From this C can calculate y as well as x'. Then, C makes 
y + x' public, which allows A (who still has x') to cal- 
culate y. Thus, every party knows the secret bit y, so 
we have got Pabc- Here, 3 bits must have been made 
public, reducing the value of S 3 from 4 to 1. 

The above table leaves open the question whether the 
conversion 



ABC 



Pabc ^ P\b 



Pic 



Pac 



is possible. We have not been able to devise a proto- 
col that carries out this transformation. Ruling out this 
possibility would probably require an additional indepen- 
dent monotone, and the five monotones listed above are 
the only ones we know at present. 

Let us note that in order to carry out the above con- 
versions, we sometimes had to suppose that one of the 
parties forgets some of his information. In practice, this is 
obviously a stupid thing to do. Why to forget something 
you know? However, there may be an accident, say an 
irrecoverable hard disk crash, such that one of the parties 
has lost part or all of his data. In this case, the mono- 
tone T n constrains how much secrecy is left among the 
parties. It would be interesting and important to study 



the restricted class of transformations in which the par- 
ties never forget their data (they would only be allowed 
to communicate classically). This would impose another 
constraint on the transformations that are possible. 



D. Extremality of the five tri-partite probability 
distributions 



The above discussion raises the general question of the 
reversible conversion of one probability distribution into 
another. By this we mean that, in the limit of a large 
number of draws, it is possible to go from one probabil- 
ity distribution Pi to another P 2 and back with negligible 
losses. In particular, in the tripartite case, one can in- 
quire whether their are yields y\ , . . . ,2/5 such that the 
reversible conversion 



Pabc ^ P 



AB 



p2«>J/2 
r BC 



r iC 69 MBC 59 ABC 



(46) 



is possible? Let us show that the five secrecy mono- 
tones introduced above leave open the possibility of the 
reversible distillation of Eq. ( ff6| ) . Whether this is possi- 
ble in practice is an open question. 

To prove this, let us introduce the following notation: 

r = I(A:B\C) , 
s = I(B:C\A) , 
t = I(C:A\B) , 

u = I{A:B) - I{A:B\C) . (47) 

Let us note that u is symmetric between the three parties 
and can also be written as u = I(B:C) — I(B:C\A) = 
I(C:A) — I(C:A\B). These different quantities can be 
represented graphically as in Fig. [I]. 




FIG. 1. Venn diagram for a tripartite probability distribu- 
tion. 

Given these quantities we can express S3 and T 3 as 

S 3 = r + s + t + u (48) 
T 3 = r + s + t + 2u . (49) 
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We note that u is not positive definite, but we have the 
positivity conditions 

r > , 

s > , 

t > , 
r + tt > , 
s + u > , 

t + u > . (50) 

Using these conditions, one can show that if u — 0, then 
the reversible conversion 



Pabc ^ P 



AB 



BC 



is allowed by our tripartite monotones. If u > 0, then 
the reversible conversion 



Pabc ^ P 



ABC 



is allowed by our tripartite monotones. If u < 0, then 
the reversible conversion 



ABC 



P 



.IB 



AC 



ABC 



is allowed by our tripartite monotones. 

Thus our monotones in principle allow the reversible 
conversion between any tripartite probability distribu- 
tion and the distributions P AB , P B ci P\c^ P%BC' an< ^ 
Pabc- Whether or not such a reversible transforma- 
tion is possible or not is an open question. To rule this 
out will probably require discovering additional secrecy 
monotones. 



E. Extremality of the monotones S3 and T3 

As a final comment about the secrecy monotones in 
the tripartite case, we note that using the distillation 



P\b an d Pabc 



P 



AB' 



we can 



procedures for P% BC 
now also prove that < A < 1 is the only range for which 
the linear combination of S3 and T3 is a monotone. This 
can be seen by calculating M3 = AS3 + (1 — \)Tz for both 
distillations. In the first case, we get that M3(P ABC ) — 
A + 1 should be greater or equal to M 3 (P^ B ) — 1, so that 
A > 0. In the second case, we find that M S (P^ BC ) — 
2 - A > M 3 (P\ B ) = 1, so that A < 1. This suggests 
that if there are other monotones than the M„'s, they 
will probably not be composed out of entropies. 



• positive, 

• vanishing on product density matrices, 

• monotonous under local operations (local CP 
maps), 

• monotonous under classical communication, 

• additive, 

• continous. 

One can also extend the quantum definition of the se- 
crecy monotone to the case where there is an eavesdrop- 
per. In that case, it is defined on a multipartite density 
matrix pA x ...A n E- The monotonicity properties are then 
modified to require that the secrecy montone is monoton- 
ically decreasing under local operations and public com- 
munication by the parties A± . . . A n and monotonically 
increasing under local operations and public communi- 
cation by Eve. 

In what follows, we shall for simplicity not include Eve 
in the discussion. That is, we shall suppose that initially 
Eve has no information about the density matrix, but she 
listens to all public communications and thereby tries to 
thwart the parties Ai . . . A n . 



B. Quantum version of the secrecy monotones S n 

and T„ 

The definitions of the monotones S n and T„, Eqs. ( |T^ ) 
and ([l7]), have straightforward generalizations to the 
quantum case: 

S n (f>Ai-A n ) 
= S(A 1 :---:A n ) 

n 

= ^2s(p Al ---A^ 1 A t+ i---A n ) - (n- l)S(p Al -A n ) (51) 



and 



TnipAt-A,,) 

= T(A 1 :---:A n ) 

n 



(52) 



V. QUANTUM MULTIPARTITE SECRECY 
MONOTONES 

A. Definition of Quantum Secrecy Monotones 

The definition of classical secrecy monotone of Section 



[I A can be immediately extended to the quantum case. 
The monotone will now be a function defined on multi- 
partite density matrices pA ± ...A n which must be: 



where now S(p) denotes the von Neumann entropy of a 
density matrix which is given by S(p) = — Tr(plog/3) and 
partial traces are written in the form pAi—Ai-iA i+1 —A n = 
Tr Ai (p Al ... An ). 

The different rewritings of S n [Eqs. (|l|), (y|), and 
(|l|)] and T n [Eqs. (|l|) and@] that where obtained in 
the classical case carry through to the quantum case, in 
analogy to the what was shown for bipartite systems in 
Jl3t . This means that the simple properties that followed 
from these rewritings in the classical case also hold in the 







quantum case. In particular, the positivity of the S n and 
T n follows from the positivity of the conditional mutual 
entropy, which holds in both the classical and quantum 
case (see [|l7) for a review). The proofs of monotonicity 
change in the quantum case, and we give them below. 

Let us note that, for pure states, S n and T n coincide 
and are equal to the sum of the local entropies: 



with 



S n (\lp Al -A n )) = T n (\ip Al ... An )) 

71 



(53) 



Thus for instance on a singlet state, 5*2 and Ti are equal 
to 2, and on a GHZ state, 53 and T 3 are equal to 3. 

We do not at present have a clear interpretation of S n 
in the quantum case. On the other hand, the interpre- 
tation of T n in the quantum case is the same as in the 
classical case. Indeed, it can be written as the minimum 
relative entropy between pA\...A n and a product density 
matrix r) Al ®- ■ -®flA n (the minimum being attained when 
fjAi — PA t )- Therefore, T n can be interpreted as the 
minimum increase of entropy of local (uncorrelated) en- 
vironnements if the parties erase all correlations between 
them by letting their quantum systems interact with a 
local environment. 



C. Monotonicity of S„ and T n 

We now give the proofs of monotonicity of S n and T n 
under local operations and classical communication in 
the quantum case. 

Local operations of one party are described mathemati- 
cally as completely positive (CP) local maps M Ai , which 
only act on the subspace of the ith party. We can as- 
sume that such a map is implemented as follows |l9| , po| : 
Ai adds to its Hilbert space an auxiliary variable in a 
pure state n aux = |0) aux (0|. It then carries out a unitary 
transformation J7i aux on its original system and the aux- 
iliary variable. Finally, it traces over a part aux' of her 
Hilbert space. Note that auxf does not have to coincide 
with aux. Hence, we can represent a local CP map as 



= Tr a 



(U AiS 



1 



A 1 ---A i - 1 A U 



In) 



■A„ 



n aux ) 



Tt 



(54) 



We start with S n and write it in the following form 
S n {A x :---:A n ) 

= S 2 {A i :A 1 ■ ■ ■ Ai^xA i+ i ■ ■ ■ A n ^A n ) 

(55) 



-A. 



A„ = Y S(pa z ) - S(p Al ... An _ 1 ) 



(56) 



Now we assume that the system A n undergoes a local 
CP map M„, Eq. (|54|). As A„ does not depend on A n 
it remains unchanged, thus we only have to check 52 
for monotonicity. For this we rewrite Eq. ( |5~4| ) for two 
systems A and B 

Pab = M A <g) t B (p AB ) 

= r Tv a ,{U Aa ®t B )PAB®^a{U\ a ®t B ) (57) 

and note that neither adding a local auxiliary nor per- 
forming a unitary transformation changes S2 ■ Tracing 
over a local subsystem, however, decreases £2 since 



S 2 {A'&ux':B) -S 2 (A':B) 
= S(eiUx':B\A') , 



(58) 



which is just the conditional mutual quantum entropy 
and which, due to strong subadditivity JlTj is seroposi- 
tive, thus implying that 



5 2 (A'aux':S) > S 2 (A':B) 



(59) 



Due to symmetry, S n given by Eq. (|55]) is then monotone 
under local CP maps of any party. 

For monotonicity under local measurements and pub- 
lic communication of their outcome, we assume that a 
positive operator valued measurement (POVM) is 
performed on system A\. This is realized by adding as 
above an ancilla n aux to A\ and then carrying out a von 
Neumann measurement that transforms p Al ... An ® n aux 
to 



/^auxAi 



auxAi ■ ■ ■ A n 



E 



~k 

PkP SkX1 xA 1 ---A r , 



(60) 



with pLxA ± -a 



n a , lx )(p auxAi 



{PLiAt ® Uz-AjipAi-An ® 

l n ) and P^ uy r Al a complete set of or- 



t M ... ■ ' 1 



thogonal projectors acting on the extended space auxAi, 
PamcAi---A being the joint state after outcome k has been 
measured and pk = ^(pZuxAi—A )■ We now go back to 
Eq. (jsil). The orthogonality of the projectors P£ uxAl im- 
plies that the pA 1 ---A i - 1 A i+1 ---A n are block diagonal for 
i 7^ 1, so that their entropies can be expressed as 

S(pA 1 --A,^ 1 A, +1 --A n ) = H\p k ] 

+J2pkS{p k Al ... Az _ lAi+1 ... A j , 

fe 

(61) 



and 



S{p Al -A n ) = H[p k ] + Y,PkS{pA x -A n ) 



(62) 
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with H[pk] denoting the classical Shannon entropy of the 
probability distribution pk ■ For i = 1 , we find the follow- 
ing inequality for the first term, which makes use of the 
concavity of entropy 



S(p 



> 



~k 

A 2 



•A„ 



)• 



(63) 



Replacing all these expressions in Eq. (|i3|), we finally find 
that 




•A„ 



> 



E 



PkS n (p Al ... A J 



(64) 



This shows that the monotone S n can only decrease on 
average if A\ performs a POVM measurement and the 
outcome is made known to the other parties. By symme- 
try, this property holds for all Ai, i = {1, . . . , n}. 

To prove the monotonicity of T n we proceed as 
follows. Suppose that A\ carries out a local CP 
map. As before adding a local ancilla and carry- 
ing out a local unitary transformation do not change 
T n . Tracing over part of Ax's Hilbert space decreases 
T n . Indeed, T n (A iai :A 2 : ■ ■ ■ :A n ) - T n (A\: ■ ■ ■ :A n ) = 
S(a\:A2 . . . A n \Ai) > 0. Suppose now that A\ carries 
out a measurement (with outcomes k) and publicly re- 
veals the result. In Eq. (|52|), the terms S(pAi) with i ^ 1 
decrease because of concavity of entropy [see Eq. (63)1 
and because the term S(oa, ) — S(oa, ...a„ ) stays constant 
[where we used Eqs. ( |6l|) and (p^)]. Hence, 

Tn ^2PkPAi-Aj A l A n) 

>^ ft r„(4... 4 ;4:...:A„) (65) 



where we have used the same notation as in Eq. 



D. Applications of quantum secrecy monotones 

The two quantum monotones described above can be 
used to provide bounds on the rate of conversion of one 
multipartite density matrix into another using local op- 
erations and classical communication. As an example, we 
study in this section and the next one how many realiza- 
tions of a correlated tripartite probability distributions 
can be obtained from a GHZ state. 

Let us recall that the GHZ state, in the z basis, is 



\GHZ) = (|000) + |111 



If the state is measured in the z basis one obtains the 
probability distribution P 3 . In contrast, if the state is 
measured in the x basis one obtains the probability dis- 
tribution P x . 

We have shown above that P 3 and P x cannot be re- 
versibly converted one into the other. This therefore 



suggests that when using a GHZ state to do multipar- 
tite quantum cryptography, there is an irreversible choice 
that must be made. However, the above discussion leaves 
open the possibility that the three parties could use a 
more sophisticated strategy than the ones just described 
and thereby obtain more than one of these probability 
distributions from a single GHZ state. 

To address this question, let us compute the monotones 
S3 and T3 on the initial state and on the final probability 
distributions. We find 



S 3 (\GHZ))=3 
S 3 (P 3 ) = 1 
S 3 (P X ) = 2 



T 3 {\GHZ)) = 3 
T 3 (P 3 ) = 2 , 
T 3 (P X ) = 1 . 



(66) 



Thus the monotones leave open the possibility of a higher 
yield than one P 3 or one P x per GHZ state. 

Let us note however an interesting feature of eq. ([6(f), 
namely that the sum of the final values of S3 and T3 is 
equal to half the sum of the initial values: 



S 3 (P 3 )+T 3 (P 3 ) 



S 3 (P X )+T 3 (P X ) 
S 3 {\GHZ))+T 3 {\GHZ)) 



(67) 



We shall now show that this is no accident but is neces- 
sarily the case when one passes from a multipartite pure 
state to a multipartite probability distribution. Thus it 
is indeed impossible to obtain more than one P 3 or one 
P x probability distribution from a single GHZ state, and 
the simple measurement strategies described above are 
therefore optimal. 

E. Decrease of S n + T n when passing from a 
multipartite pure state to a multipartite probability 
distribution 

Let us suppose that initially the parties share a multi- 
partite pure state \*&a 1 ...a„)- Initially 

S n {\\Psi Al ...Aj) = T n (\y Al ...A n )) = J2 S (PA<) ■ (68) 



Suppose that the aim of the parties is to obtain, by carry- 
ing out local measurements and classical communication, 
a multipartite probability distribution Pai...A„' hi doing 
so, the monotones S n and T n will decrease. More pre- 
cisely, the amount by which they decrease is such that 
their sum is decreased by at least a factor two: 



S n (P Al ...A n ) + T n (P Al ...A n ) < S( -P A ^ 



(69) 



To prove this, let us first consider the bipartite case. 
Thus initially the parties share a pure state I^ab) and 
they carry out measurements so as to obtain a probability 
distribution Pab ■ Let us first suppose that no communi- 
cation takes place between the parties. Then, it follows 
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from Holevo's bound (TS| that the mutual information 
between Alice and Bob after the measurement is neces- 
sarily less than the local entropies of the original state: 



S{p A ) = S(p B ) > I Pab (A:B) 



(70) 



Equality is attained in Eq. ( |70| ) only if they measure in 
the Schmidt basis. 

Let us now show that Eq. (|7(]) also holds if the parties 
communicate classically. We will suppose that the com- 
munication takes place in a series of rounds. During each 
round, one of the parties carries out a partial measure- 
ment on the state and communicates information to the 
other party. After all the communication has taken place 
the parties measure the state they are left with. Such a 
general protocol is difficult to analyze, but we can trans- 
form it into a simpler protocol. In the simpler protocol, 
during each round the party transmits all the informa- 
tion obtained by the partial measurement to the other 
party. This should be contrasted with the most general 
protocol in which only part of the information obtained 
by the measurement is transmitted. The simplification 
follows from the fact that we can divide the measurement 
into a first partial measurement in which the information 
transmitted to the other party is obtained, and a sec- 
ond partial measurement in which the information that 
is kept is obtained. But the second partial measurement 
could then as well be carried out during the next round. 
Repeating this reasoning round after round, we can con- 
struct a simpler protocol in which the information that is 
not communicated to the other party is acquired during 
the last round only. 

In the case of the simplified protocol, one can easily 
show that Eq. ( |7(i| ) holds. Consider the first round. Sup- 
pose that Alice carries out a partial measurement. The 
measurement has outcomes k, with probabilities p(k). 
The state if the outcome is k is ^\b- Because of mono- 
tonicity of the quantum mutual information, we have 



S( PA )>Y,P(k)S(PA) 



(71) 



The local entropies decrease (on average) due to the com- 
munication. The same will hold for all the subsequent 
rounds. Hence, Eq. ( f70| ) holds also if the parties carry 
out public communication. In fact that above reason- 
ing shows that the optimal strategy is for the parties not 
to communicate, but simply to measure the state in the 
Schmidt basis. 

Finally let us consider the multipartite case. The result 
for two parties Eq.([70|) implies that for any partition of 
the parties into one party, say i, and n — 1 parties, the 
mutual information between i and the n—1 other parties 
after the measurements is bounded by 

J(A:4l • ■ ■ Ai^A i+1 . . . A n ) < S(p(A t )) . (72) 

Summing over i and using Eq. (p2|), we find that 



S n (P) + T n {P)<J2S(p(Ai)) 

i 

which is what we wanted to prove. 



(73) 



VI. CONCLUSION 

In this article, we have introduced the concept of 
secrecy monotones which are powerful tools to obtain 
bounds on the distillation rate in Maurer's classical cryp- 
tographic scheme as well as bounds on the distillation 
rate in quantum cryptography. 

We introduced two independent multipartite secrecy 
monotones based on (Shannon or von Neuman) entropies, 
S n and T n , which allowed us to investigate the distil- 
lation rates for multipartite cryptographic schemes. In 
the classical case, we studied in detail the tripartite case 
and showed that their are several inequivalent tripartite 
probability distributions in the sense that they cannot be 
converted reversibly one into the other. We also studied 
the particular case of tripartite quantum cryptography 
based on the GHZ state. We showed that the parties 
must choose a priori which probability distribution they 
want to generate. 

The important feature that emerges from our study is 
thus that in multipartite classical or quantum cryptogra- 
phy, the parties must make an irreversible choice on what 
final probability distribution they want to obtain. Mak- 
ing the wrong choice entails an irreversible loss. We note 
that this feature is not unique to cryptography; indeed, a 
similar situation arises in multipartite entanglement dis- 
tillation since there are entangled pure states that cannot 
be reversibly converted one into the other (TjJ^]. 

Note: After this paper was completed, we learned of 
the work | pl| in which monotones (under certain classes 
of operations) which are positive both on quantum states 
and on probability distributions are considered in the bi- 
partite case. 
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